From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B4A93918B4; Sat, 28 Feb 2026 17:37:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300220; cv=none; b=I0Yacqoz+/E/sLtIivRqXepovewEmPzbL1G9GCFKipcWWp/Jb39RxV24++52rHAzIzfmpV7haECB/QcRK2t++PZ3ZKRan7wC3y0kg/zd4wcpSQ+0cq8mqM+c9+TYdiPDG4HpZ0DOLjBFTV2z6ENV92p/Jttjxnuh9L08IktqCV8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300220; c=relaxed/simple; bh=HBtUASG2A6midTqyxuI2ibO+q8ZfngpiNs8bogOQx8g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N2wnMB+NqNupqGDGPw+HzYLUUnFU9DA+wZ7RPU8dygQLIDXFOvPMyYoqwvupc88oN2ZiisdEfLqmtFh59qZ1kof2eZKDifeF+rhkUiZSHExfkuoE9TB0Hn/gWqMcvVHHpkxtqXhHJ4wLs+PkM/iPct+FAY53iDqJdKKTc6V2r3w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Cr7/DPl9; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Cr7/DPl9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1E377C2BC87; Sat, 28 Feb 2026 17:36:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772300220; bh=HBtUASG2A6midTqyxuI2ibO+q8ZfngpiNs8bogOQx8g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Cr7/DPl9WL/F1fEQIbgdCU4fr1Sn2Ku9Ro9Q+DqEeAf8dghHxEkjKD8HdcDwMBYsB PysvOcPxG9r1tswwXZcNoUWm49KmGfKQ6TnKBiFPIYybOIdisGssbZYRGbfvidCKWB 5l49scfcRDm2g8gEW+3EDP2XkjgPFYv9FPT+Q5uOE5bger3rkMQzI+UAI2OLlpMCLA 7Lz9u8YnaW1P72+TgWQdoXQdJUEKXUlQ7KS5Pzg39fdvCFUmt7CmeREtvWTiyz9+dX Ghx48eJu/esCA6hnw2AnXS+0JJpsbyjWA7LtNkq77DhGEOg9CRqg7bh+qfKMfHUo2a 9p7OkgttqLjAA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ranjani Sridharan , Bard Liao , Liam Girdwood , Mateusz Redzynia , Peter Ujfalusi , Mark Brown , Sasha Levin Subject: [PATCH 6.19 240/844] ASoC: SOF: Intel: hda: Fix NULL pointer dereference Date: Sat, 28 Feb 2026 12:22:33 -0500 Message-ID: <20260228173244.1509663-241-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org> References: <20260228173244.1509663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Ranjani Sridharan [ Upstream commit 16c589567a956d46a7c1363af3f64de3d420af20 ] If there's a mismatch between the DAI links in the machine driver and the topology, it is possible that the playback/capture widget is not set, especially in the case of loopback capture for echo reference where we use the dummy DAI link. Return the error when the widget is not set to avoid a null pointer dereference like below when the topology is broken. RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common] Signed-off-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Reviewed-by: Mateusz Redzynia Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20260204081833.16630-10-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- sound/soc/sof/intel/hda-dai.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c index 883d0d3bae9ec..3c742d5351333 100644 --- a/sound/soc/sof/intel/hda-dai.c +++ b/sound/soc/sof/intel/hda-dai.c @@ -70,12 +70,22 @@ static const struct hda_dai_widget_dma_ops * hda_dai_get_ops(struct snd_pcm_substream *substream, struct snd_soc_dai *cpu_dai) { struct snd_soc_dapm_widget *w = snd_soc_dai_get_widget(cpu_dai, substream->stream); - struct snd_sof_widget *swidget = w->dobj.private; + struct snd_sof_widget *swidget; struct snd_sof_dev *sdev; struct snd_sof_dai *sdai; - sdev = widget_to_sdev(w); + /* + * this is unlikely if the topology and the machine driver DAI links match. + * But if there's a missing DAI link in topology, this will prevent a NULL pointer + * dereference later on. + */ + if (!w) { + dev_err(cpu_dai->dev, "%s: widget is NULL\n", __func__); + return NULL; + } + sdev = widget_to_sdev(w); + swidget = w->dobj.private; if (!swidget) { dev_err(sdev->dev, "%s: swidget is NULL\n", __func__); return NULL; -- 2.51.0